CVE-2023-43754CWE-200

Permalink previews displayed for posts in archived channels even if users are disallowed to view archived channels

Medium · published November 27, 2023

CVSS v3.1
4.3
EPSS
1%
Percentile
42.3
In the wild
Unconfirmed
What it is

Mattermost fails to check whether the  “Allow users to view archived channels”  setting is enabled during permalink previews display, allowing members to view permalink previews of archived channels even if the “Allow users to view archived channels” setting is disabled.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00506 · 42.3th percentile
Weakness
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2023-11-27T09:11Z
EPSS history
Timeline
  • 27 NOV 09:11Z
    Permalink previews displayed for posts in archived channels even if users are disallowed to view archived channels
    cvelistv5